Application No. 10/523,690 Docket No.: 1560-0422PUS1 

Amendment dated January 5, 2010 

After Final Office Action of October 8, 2009 

REMARKS 

Claims 1-3, 7, 8, and 11 are currently pending, wherein claims 1-3, 7, and 8 have been 
amended, and claims 4, 5, 9, and 10 are canceled. Favorable reconsideration is respectfully 
requested in view of the remarks presented herein below. 

At the outset, Applicant would like to thank Examiner Schwartz for the courtesy shown 
Applicant's Representatives during the personal Interview conducted on December 15, 2009. 
The Examiner summary of the interview provided in paper no. 20091216 is an accurate summary 
of the interview. Accordingly, Applicant is not providing any further comments. 

In paragraph 1 of the final Office action ("Action"), the Examiner rejects claims 1-5 and 
7-1 1 under 35 U.S.C. § 103(a) as being unpatentable over Japanese Publication No. JP 09-128264 
to Sakai et al. ("Sakai"), in view of U.S. Patent No. 6,301,699 to Hollander et al. ("Hollander"), 
further in view of U.S. Patent Application Publication No. 2001/0011346 Al to Yoshimi 
("Yoshimi"). Applicant respectfully traverses this rejection. 

In order to support a rejection under 35 U.S.C. § 103, the Examiner must establish a 
prima facie case of obviousness. To establish a prima facie case of obviousness three criteria 
must be met. First, there must be some rationale to combine the cited references. Second, there 
must be a reasonable expectation of success. Finally, the combination must teach each and every 
claimed element. In the present case, presently pending claims 1-3, 7, 8, and 11 are patentable 
over the combination of Sakai, Hollander and Yoshimi because the combination fails to disclose 
each and every claimed element as discussed below. 

Claims 1, 2, 3, 7, 8, and 1 1 each recite, inter alia, concluding that the input data includes 
a malicious process if the stored call destination address is between the branch origin address and 
the branch destination address. In other words, the claimed invention concludes that the 
instruction codes within the received input data include a malicious process if it is determined 
the destination address of a forward branch instruction is a call instruction and the address of the 
call instruction is located between the branch origin address and the branch destination address. 

Sakai discloses a controller and control method configured to recognize a subroutine 
control part in a microprogram by detecting a subroutine call instruction and a return instruction 
from the subroutine and efficiently collect trace information. More specifically, Sakai discloses 
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a rear branch detecting part for determining whether or not a rear branch has occurred (i.e., 
branch whose destination address is less then its origin address) and a call instruction detecting 
part and RET instruction detecting part for determining whether a subroutine has been called 
from within the rear branch. However, nowhere in Sakai is there any disclosure or suggestion to 
determine whether a forward branch has occurred, much less whether the destination address of a 
forward branch is associated with a call instructions whose destination address is between the 
origin and destination address of the branch instruction as claimed. 

Hollander discloses a method/process that intercepts a called function and performs a 
process of detecting an attempt to exploit a buffer overflow weakness, according to step 102 of 
Fig. 4A. This process is illustrated in detail by Fig. 5 of Hollander, and includes an analysis of 
code to determine execution paths and invalid jump instructions. However, nowhere in 
Hollander is there any disclosure or suggestion of determining whether the data includes 
instructions for a forward branch where the destination address of the forward branch is 
associated with a call instructions whose destination address is between the origin and 
destination address of the branch instruction as claimed. 

Yoshimi discloses a branch prediction method that predicts/detects forward and backward 
branches. However, Yoshimi, like Sakai and Hollander, fails to disclose detecting/determine 
whether the destination address of a forward branch is associated with a call instruction, where 
the destination address of the call instruction is between the origin and destination of the branch 
instruction as claimed. 

Since, Sakai, Hollander, and Yoshimi each fail to disclose or suggest concluding that the 
input data includes a malicious process if the stored call destination address is between the 
branch origin address and the branch destination address as claimed, the combination of these 
three references cannot possibly disclose or suggest said element. Therefore, even if one skilled 
in the art had some rationale to combine Sakai, Hollander, and Yoshimi (which Applicant does 
not concede), the combination would still fail to render claims 1, 2, 3, 7, 8, and 11 unpatentable 
because the combination fails to disclose each and every claimed element. 

Claims 3 and 1 1 depend from independent claims 2 and 1 , respectively. Accordingly, 
claims 3 and 1 1 are patentable over the combination of Sakai, Hollander, and Yoshimi for at 
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least those reasons presented above with respect to claims 2 and 1. Reconsideration and 
withdrawal of the rejection of claims 1-3, 7, 8, and 1 1 is respectfully requested. 

The application is in condition for allowance. Notice of same is earnestly solicited. 
Should there be any outstanding matters that need to be resolved in the present application, the 
Examiner is respectfully requested to contact Penny Caudle Reg. No. 46,607 at the telephone 
number of the undersigned below, to conduct an interview in an effort to expedite prosecution in 
connection with the present application. 

If necessary, the Commissioner is hereby authorized in this, concurrent, and future replies 
to charge payment or credit any overpayment to Deposit Account No. 02-2448 for any additional 
fees required under 37.C.F.R. §§1.16 or 1.17; particularly, extension of time fees. 

Dated: January 5, 2010 Respectfully submitted, 




-Michael K. Mutttf 
Registration No.: 29,680 

BIRCH, STEWART, KOLASCH & BIRCH, LLP 
81 10 Gatehouse Road 
Suite 100 East 
P.O. Box 747 

Falls Church, Virginia 22040-0747 
(703) 205-8000 
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